Skip to content
CVE PROGRAM SOURCE RECORD6.5 Medium

CVE-2026-103005

Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Memory Allocation with Excessive Size Value (CWE-789) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user with connector management privileges could cause the cluster to allocate an uncontrolled amount of memory when connector resources with an excessively large `description` field are created and subsequently accessed, exhausting available heap memory and crashing the affected node.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Elasticsearch

Default version status: unaffected

  • 8.12.0 to ≤ 8.19.22affected
  • 9.0.0 to ≤ 9.3.8affected
  • 9.4.0 to ≤ 9.4.7affected
  • 9.5.0 to ≤ 9.5.4affected

References